Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6;
MIME-Version: 1.0
References: <AM9P192MB12672AA34A0480B522D23741E8C8A@AM9P192MB1267.EURP192.PROD.OUTLOOK.COM>
 <2023100727-passive-untidy-8df4@gregkh> <AM9P192MB1267C58F299DF86A5EEFE39EE8C8A@AM9P192MB1267.EURP192.PROD.OUTLOOK.COM>
In-Reply-To: <AM9P192MB1267C58F299DF86A5EEFE39EE8C8A@AM9P192MB1267.EURP192.PROD.OUTLOOK.COM>
From:   Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date:   Mon, 9 Oct 2023 12:50:25 -0700
Message-ID: <CABBYNZLA2aTwRFqeDNLaT6Q4cytLB1e-q5oON=KVK1ts-0dz1w@mail.gmail.com>
Subject: Re: [PATCH] Bluetooth: hci_conn_failed: Fixes memory leak
To:     Yuran Pereira <yuran.pereira@hotmail.com>
Cc:     Greg KH <gregkh@linuxfoundation.org>,
        "marcel@holtmann.org" <marcel@holtmann.org>,
        "johan.hedberg@gmail.com" <johan.hedberg@gmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
        "syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com" 
        <syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com>,
        "linux-kernel-mentees@lists.linuxfoundation.org" 
        <linux-kernel-mentees@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Yuran,

On Sat, Oct 7, 2023 at 10:39=E2=80=AFAM Yuran Pereira <yuran.pereira@hotmai=
l.com> wrote:
>
> Hello Greg,
> My apologies, I just noticed that my patch is based on the mainline tree.=
 I'll re-submit one based on the Bluetooth tree and I'll ensure to include =
the commit id that it's fixing.
>
> Thanks,
> Yuran Pereira
> ________________________________
> De: Greg KH <gregkh@linuxfoundation.org>
> Enviado: 7 de outubro de 2023 11:41
> Para: Yuran Pereira <yuran.pereira@hotmail.com>
> Cc: marcel@holtmann.org <marcel@holtmann.org>; johan.hedberg@gmail.com <j=
ohan.hedberg@gmail.com>; linux-kernel@vger.kernel.org <linux-kernel@vger.ke=
rnel.org>; linux-bluetooth@vger.kernel.org <linux-bluetooth@vger.kernel.org=
>; luiz.dentz@gmail.com <luiz.dentz@gmail.com>; syzbot+39ec16ff6cc18b1d066d=
@syzkaller.appspotmail.com <syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotma=
il.com>; linux-kernel-mentees@lists.linuxfoundation.org <linux-kernel-mente=
es@lists.linuxfoundation.org>
> Assunto: Re: [PATCH] Bluetooth: hci_conn_failed: Fixes memory leak
>
> On Sat, Oct 07, 2023 at 05:09:01PM +0530, Yuran Pereira wrote:
> > The hci_conn_failed() function currently calls hci_connect_cfm(), which
> > indirectly leads to the allocation of an l2cap_conn struct in l2cap_con=
n_add().
> > This operation results in a memory leak, as the l2cap_conn structure
> > becomes unreferenced.
> >
> > To address this issue and prevent the memory leak, this patch modifies
> > hci_conn_failed() to replace the call to hci_connect_cfm() with a
> > call to hci_disconn_cfm().

I suspect this is not quite right, hci_disconn_cfm is called when a
disconnection has been requested, hci_connect_cfm is correct here
since it is meant to notify the result of connection request procedure
so I can only assume that the culprit here is that hci_conn_failed is
called with status 0 which is invalid and needs fixing.

> > Reported-by: syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
> > Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
> > ---
> >  net/bluetooth/hci_conn.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> What commit id does this fix?
>
> thanks,
>
> greg k-h


--=20
Luiz Augusto von Dentz